Section 4 · Data Protection Act 1988

Contents

4Right of access.#

—(1) (a) Subject to the provisions of this Act, an individual shall, if he or she so requests a data controller by notice in writing—

(i)be informed by the data controller whether the data processed by or on behalf of the data controller include personal data relating to the individual,

(ii)if it does, be supplied by the data controller with a description of—

(I)the categories of data being processed by or on behalf of the data controller,

(II)the personal data constituting the data of which that individual is the data subject,

(III)the purpose or purposes of the processing, and

(IV)the recipients or categories of recipients to whom the data are or may be disclosed,

(iii)have communicated to him or her in intelligible form—

(I)the information constituting any personal data of which that individual is the data subject, and

(II)any information known or available to the data controller as to the source of those data unless the communication of that information is contrary to the public interest,

and

(iv)where the processing by automatic means of the data of which the individual is the data subject has constituted or is likely to constitute the sole basis for any decision significantly affecting him or her, be informed free of charge by the data controller of the logic involved in the processing,as soon as may be and in any event not more than 40 days after compliance by the individual with the provisions of this section and, where any of the information is expressed in terms that are not intelligible to the average person without explanation, the information shall be accompanied by an explanation of those terms.

(b)A request under paragraph (a) of this subsection that does not relate to all of its subparagraphs shall, in the absence of any indication to the contrary, be treated as relating to all of them.

(c)(i) A fee may be payable to the data controller concerned in respect of such a request as aforesaid and the amount thereof shall not exceed such amount as may be prescribed or an amount that in the opinion of the Commissioner is reasonable, having regard to the estimated cost to the data controller of compliance with the request, whichever is the lesser.

(ii)A fee paid by an individual to a data controller under subparagraph (i) of this paragraph shall be returned to him if his request is not complied with or the data controller rectifies or supplements, or erases part of, the data concerned (and thereby materially modifies the data) or erases all of the data on the application of the individual or in accordance with an enforcement notice or an order of a court.

(2)

(3)An individual making a request under this section shall supply the data controller concerned with such information as he may reasonably require in order to satisfy himself of the identity of the individual and to locate any relevant personal data or information.

(4)

(4A)(a) Where personal data relating to a data subject consist of an expression of opinion about the data subject by another person, the data may be disclosed to the data subject without obtaining the consent of that person to the disclosure.

(b)Paragraph (a) of this subsection does not apply—

(i)to personal data held by or on behalf of the person in charge of an institution referred to in section 5(1)(c) of this Act and consisting of an expression of opinion by another person about the data subject if the data subject is being or was detained in such an institution, or

(ii)if the expression of opinion referred to in that paragraph was given in confidence or on the understanding that it would be treated as confidential.

(5)Information supplied pursuant to a request under subsection (1) of this section may take account of any amendment of the personal data concerned made since the receipt of the request by the data controller (being an amendment that would have been made irrespective of the receipt of the request) but not of any other amendment.

(6)

(7)A notification of a refusal of a request made by an individual under and in compliance with the preceding provisions of this section shall be in writing and shall include a statement of the reasons for the refusal and an indication that the individual may complain to the Commissioner about the refusal.

(8)(a) If and whenever the Minister considers it desirable in the interests of data subjects or in the public interest to do so and by regulations so declares, the application of this section to personal data—

(i)relating to physical or mental health, or

(ii)kept for, or obtained in the course of, carrying out social work by a Minister of the Government, a local authority, a health board or a specified voluntary organisation or other body,may be modified by the regulations in such manner, in such circumstances, subject to such safeguards and to such extent as may be specified therein.

(b)Regulations under paragraph (a) of this subsection shall be made only after consultation with the Minister for Health and any other Minister of the Government who, having regard to his functions, ought, in the opinion of the Minister, to be consulted and may make different provision in relation to data of different descriptions.

(9)The obligations imposed by subsection (1)(a)(iii) (inserted by the Act of 2003) of this section shall be complied with by supplying the data subject with a copy of the information concerned in permanent form unless—

(a)the supply of such a copy is not possible or would involve disproportionate effort, or

(b)the data subject agrees otherwise.

(10)Where a data controller has previously complied with a request under subsection (1) of this section, the data controller is not obliged to comply with a subsequent identical or similar request under that subsection by the same individual unless, in the opinion of the data controller, a reasonable interval has elapsed between compliance with the previous request and the making of the current request.

(11)In determining for the purposes of subsection (10) of this section whether the reasonable interval specified in that subsection has elapsed, regard shall be had to the nature of the data, the purpose for which the data are processed and the frequency with which the data are altered.

(12)Subsection (1)(a)(iv) of this section is not to be regarded as requiring the provision of information as to the logic involved in the taking of a decision if and to the extent only that such provision would adversely affect trade secrets or intellectual property (in particular any copyright protecting computer software).

(13)Any question which may arise between the Committee and any other party to an admission agreement relating to the construction of the agreement or to the rights and obligations under that agreement shall be referred in writing for determination to the Department.

Contains Revised Acts prepared by the Law Reform Commission (revisedacts.lawreform.ie): legislative text under the Oireachtas (Open Data) PSI Licence, annotations under CC BY 4.0. Revised Acts are administrative consolidations, not authoritative.